4 ms·
yeah. i wonder how hard it is to combine modules like that. you don't really even need an auth key, just a session key? one other problem is csrf issues.
by joshu 15y ago
yeah. i wonder how hard it is to combine modules like that.
you don't really even need an auth key, just a session key?
one other problem is csrf issues.
- buu700 15y agoWell, my idea was to use the hash as a way to actually find the data, but I'm sure there's a way to make it work with a session key too. It looks like Webdis has support for basic access control, but I'm not 100% clear on how well it would work for securely throwing database logic into the client: http://webd.is/#acl http://webd.is/#acl Also, while not related to Redis, this similar project looks pretty sexy: https://github.com/thurloat/httpdb https://github.com/thurloat/httpdb --- Edit: I haven't tested Webdis, but since HTTPDB has a publicly available version for testing, I decided to play around with it, and here's one way my auth key idea could be made to work pretty simply: http://httpdbapp.appspot.com/set/address:AUTH/1000%20Wrong%20Way%0ANew%20York,%20NY%2010001%0AUnited%20States http://httpdbapp.appspot.com/set/address:AUTH/1000%20Wrong%2... http://httpdbapp.appspot.com/get/address:AUTH http://httpdbapp.appspot.com/get/address:AUTH The main danger here is that it doesn't look like there's any sort of protection against malicious users filling the database with junk data to run up your GAE quota, or potentially overwriting non-private values and messing up random parts of the application. Also, I just noticed that the last commit was two years ago, so I'll look around to see if something similar but more secure is out there.
- buu700 15y agoEdit: We dream it, and Firebase delivers! (They even have an authentication system, though the documentation isn't public yet.) http://news.ycombinator.org/item?id=3831778 http://news.ycombinator.org/item?id=3831778